Date: Mon, 1 Nov 1999 17:45:05 -0800 From: Brooks Davis <brooks@one-eyed-alien.net> To: Oliver Fromme <olli@dorifer.heim3.tu-clausthal.de> Cc: freebsd-questions@FreeBSD.ORG Subject: Re: How to route a single box into a subnet Message-ID: <19991101174505.C24275@orion.ac.hmc.edu> In-Reply-To: <199911020121.CAA26450@dorifer.heim3.tu-clausthal.de>; from olli@dorifer.heim3.tu-clausthal.de on Tue, Nov 02, 1999 at 02:21:47AM %2B0100 References: <199911020121.CAA26450@dorifer.heim3.tu-clausthal.de>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Nov 02, 1999 at 02:21:47AM +0100, Oliver Fromme wrote:
> We have a /24 subnet (let's call it 1.2.3.0), and for some
> technical reason there is one machine (1.2.3.55) that has
> to be routed through another machine (1.2.3.44).
>
> The router (.44) runs FreeBSD -stable and has two network
> interfaces -- one is connected to the rest of the network,
> and the other is connected directly to the .55 machine (via
> a crossed TP cable). The .55 machine has only one network
> interface, and it's running various operating systems (W95,
> Linux, FreeBSD).
>
> What is the easiest way to do such a setup? Of course,
> the .55 box should have full internet access. All IPs are
> static, no dial-up. It is not possible to change the
> configuration of other boxes or gateways on the network,
> i.e. the routing has to be "hidden" -- I guess that means
> that an arp proxy is required.
>
> At first, I tried to setup the two interfaces of the router
> machine like this:
>
> 1.2.3.44 netmask 255.255.255.0 (the "outer" one)
> 1.2.3.45 netmask 255.255.255.255 (the "inner" one)
>
> and then enable IP forwarding, and run choparp (from ports/
> net) as a proxy arp server. However, it just didn't work.
> A simple "ping" resulted in error messages from the arp
> resolver ("could not allocate llinfo" or similar -- I can
> reproduce it and copy the exact error message if someone
> wants to see it). I guess it's because the kernel doesn't
> like that the .55 box was not within the network of the .45
> interface of the router (even though the router had a static
> route for that box, of course).
The chose of .45 and .55 means it won't work that way. If you want to
treat a link as though it's on a subnet, then everything you want it to
talk to without going through a router must be within the subnet.
If you want to deal with it like a subnet you must allocate 4 adjacent
(and properly aligned) addresses since you must allocate in powers of
two and you must have a broadcast address.
> So, what should I try next? Using "private" address spaces
> (e.g. 10.x.x.x) between the two boxes, and ipnat on the
> router to translate it to the normal .55 address? I still
> need an arp proxy in that case, don't I? (I've never done
> anything with ipnat or NAT in general before, so I'm a bit
> unsure.)
If believe you should be able to setup the link between them as a
point-to-point link. To do on the router machine just do:
ifconfig <interface> inet 1.2.3.45 1.2.3.55
Actually, if my tests with ppp over ssh vpns hold true in general you
could avoid using a public IP address on the backside of the router by
doing something like this:
1.2.3.0/24 <----> [1.2.3.44 10.0.0.1] <---> 1.2.3.55
subnet router PtP
Then 1.2.3.55 uses 10.0.0.1 as it's default router.
I haven't tested this configuration but I have a system which looks like
this which uses many of the same principles:
router
1.2.3.0/24 <---> [1.2.3.32 1.2.3.33] <---> 1.2.3.32/28
DSL [ 10.0.1.1 ] Ether
^
| VPN (ppp over ssh)
+--> [1.2.3.40]
The router in the middle proxies 1.2.3.32/28 on 1.2.3.32 and 1.2.3.40 on
1.2.3.33.
-- Brooks
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19991101174505.C24275>